Comment by nariinano

I believe urllib3 is built-in. So if you have installed it from PyPI you've gotten a malicious version.